Vulnerabilities in mina-core and apache-avro

[JosteinEntur]

Hi!
I'm Jostein Sæle from the Norwegian company Entur. We're using kafka-schema-registry-gradle-plugin 2.3.2, and we've gotten a dependabot alert in GitHub about two critical vulnerabilties, introduced transitively via kafka-schema-registry.

One in Apache MINA Deserialization. Apparently it stems from org.apache.mina:mina-core 2.2.2. We get this message:

Transitive dependency org.apache.mina:mina-core 2.2.2 is introduced via
com.github.imflog:kafka-schema-registry-gradle-plugin 2.3.2 

The vulnerabilty is: CVE-2024-52046

The other gives a similar message, and apparently stems from org.apache.avro:avro 1.11.3. The vulnerability is: CVE-2024-47561

Any thoughts about these vulnerabilities, and how we could eliminate them?

Thanks!
-Jostein-

[ImFlog]

Hello, an issue was previously opened about this vulnerability.
You can find some details here -> #209

TLDR: transitive dependency on a functionnality not used by the plugin. Will keep on updating the direct dependency until it's fixed.

Hope it helps :)

[JosteinEntur]

Thank you for the quick answer! That's good to know 👍